docs/security/TLS-configuration.md

43 to the default openssl configuration file.
48 system. For Ubuntu it is usually `/usr/lib/ssl/openssl.cnf`, but can also can be
49 at `/etc/ssl/openssl.cnf`. For Cygwin it might be
50 `/etc/defaults/etc/pki/tls/openssl.cnf` or `/etc/pki/tls/openssl.cnf`.
55 cp /usr/lib/ssl/openssl.cnf openssl-client.cnf
58 Then open the client `~/ca/openssl-client.cnf` file in your favorite editor, for
62 vi ~/ca/openssl-client.cnf
79 Now create a server configuration `openssl-server.cnf` by copying the client
83 cp ~/ca/openssl-client.cnf openssl-server.cnf
123 openssl genrsa -out CA-key.pem 2048
131 openssl req -new -config openssl-client.cnf -key CA-key.pem -x509 -days 1000 -out CA-cert.pem
142 openssl genrsa -out client-key.pem 2048
152 openssl req -new -config openssl-client.cnf -key client-key.pem -out signingReqClient.csr
159 openssl x509 -req -extensions my_ext_section -extfile myext-client.cnf -days 365 -in signingReqClie…
174 openssl genrsa -out server-key.pem 2048
186 openssl req -new -config openssl-server.cnf -key server-key.pem -out signingReqServer.csr
193 openssl x509 -req -extensions my_ext_section -extfile myext-server.cnf -days 365 -in signingReqServ…
204 openssl x509 -in CA-cert.pem -text -noout
205 openssl x509 -in client-cert.pem -text -noout
206 openssl x509 -in server-cert.pem -text -noout
207 openssl req -in signingReqClient.csr -noout -text
208 openssl req -in signingReqServer.csr -noout -text